RE: Consolidate logwatch message from all servers to 1 server

Oops, my mistake. It should be:

*.info;mail.none;authpriv.none;cron.none;local2.!warn;local3.!warn;local
4.!warn            /var/log/messages

Your syslog server is RHEL3, correct? I am not aware that the "!" syntax
is supported by platforms other than Linux - it definitely is not
supported on HP-UX.

Kevin

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Leuy Eeelyu
Sent: Thursday, June 15, 2006 11:21 AM
To: Discussion of Red Hat Enterprise Linux 3 (Taroon)
Subject: RE: Consolidate logwatch message from all servers to 1 server

Hi.. thanks but after I added the following entry, /var/log/messages no
longer log messages.  You
sure it is correct? I read on man syslog.conf, it doesn't have this
example :(

--- "Collins, Kevin [MindWorks]" <[email protected]> wrote:

> Sure, just change the 1st line to this:
> 
>
*.info;mail.none;authpriv.none;cron.none;!local2.warn;!local3.warn;!loca
> l4.warn            /var/log/messages 
> 
> It would be a VERY good idea to read the output from 'man
syslog.conf'.
> 
> Kevin
> 
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Leuy Eeelyu
> Sent: Thursday, June 15, 2006 10:14 AM
> To: Discussion of Red Hat Enterprise Linux 3 (Taroon)
> Subject: RE: Consolidate logwatch message from all servers to 1 server
> 
> Hi. Thanks,
> 
> I got it remote logging working now,  but I have the following problem
> 
> I have the following entries local2,3,4 in my syslog.conf that accept
> the logging from my Cisco
> device, but local2,3,4.warn log will go into /var/log/messages as
well.
> As *.info include *.warn
> too
> 
> *.info;mail.none;authpriv.none;cron.none;
> /var/log/messages
> local2.warn
> /var/log/local2
> local3.warn
> /var/log/local3
> local4.warn
> /var/log/local4
> 
> May I know how to exclude the local.2,3,4.warn in /var/log/messages ?
> 
> 
> --- "Sharpe, Sam J" <sam.sharpe-AQ/[email protected]> wrote:
> 
> > > -----Original Message-----
> > > From: [email protected] 
> > > [mailto:[email protected]] On Behalf Of Leuy Eeelyu
> > > Sent: 15 June 2006 10:07
> > > 
> > > > 2) setup the clients to syslog to remote server
> > > > 
> > > > To set machines to log centrally, edit /etc/syslog.conf and 
> > > add a line
> > > > like:
> > > > *.info @logmachine.example.com
> > > 
> > > 
> > > Hi ALL.. I am sorry to ask again, I had create a hostname of 
> > > abc.mycompany.com to map to the logserver IP 10.10.10.10 for 
> > > example in /etc/hosts
> > > 
> > > and in /etc/syslog.conf
> > > I have this 
> > > *.info;mail.none;authpriv.none;cron.none                
> > > @abc.mycompany.com
> > 
> > That looks good (but is it on one line?) - my original email got
> folded
> > and so did yours.
> > 
> > > And in the logserver, I have added SYSLOGD_OPTIONS="-m 0 -r" 
> > > in /etc/sysconfig/syslog and restart syslog in client and server
> > > 
> > > But I don't see any connection from client to logserver at 
> > > all and also no log is recorded in the logserver.  Anything wrong?
> > 
> > Is there a firewall on your logserver? Try turning it off - or
opening
> > port 514 for UDP.
> > 
> > > Besides, I want to know what is the file location on the 
> > > logserver that the client will log to ? 
> > > in the client's /etc/syslog.conf, it has @abc.mycompany.com 
> > > but it did not specify what file location in logserver.  
> > 
> > Ahh, now this is the problem. On your server, ALL the log messages
> will
> > be consolidated in your usual locations. So if your sshd login
> messages
> > on the server go to /var/log/secure, all the sshd login messages on
> the
> > clients will go to the server's /var/log/secure. This is the
> limitation
> > we found with the standard syslogd - you can't separate logs by
> > hostname.
> > 
> > If you install syslog-ng you can do groovy things in
> > /etc/syslog-ng/syslog-ng.conf like:
> > 
> > destination logpile {
> >   file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"
> >   owner(root) group(root) perm(0600)
> >   create_dirs(yes) dir_perm(0700)); };
> > 
> > log { source(s_sys); destination(logpile); };
> > 
> > And that will separate out your log messages on a per-host/per-time
> > basis. You can also configure multiple destinations so we also have
a
> > massive "everything" log that gets rotated regularly but is not
> > separated by hostname. This is the log that logwatch or swatch
parses
> > for all the messages from all the machines.
> > 
> > destination everything {
> >   file("/var/log/everything" owner(root) group(root) perm(0644)); };
> > log { source(s_sys); destination(everything); };
> > 
> > Hope that helps,
> > 
> > Sam
> > 
> > --
> > Taroon-list mailing list
> > [email protected]
> > https://www.redhat.com/mailman/listinfo/taroon-list
> > 
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> 
> --
> Taroon-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/taroon-list
> 
> 
> 
> --
> Taroon-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/taroon-list
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list



--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list